CVE-2025-38008

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: fix race condition in unaccepted memory handling The page allocator tracks the number of zones that have unaccepted memory using staticbranchenc/dec and uses that static branch in hot paths to determine if it needs ...

CVE-2025-38010

In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking The current implementation uses biaspadenable as a reference count to manage the shared bias pad for all UTMI PHYs. However, during system suspension with connecte...

CVE-2025-38006

In the Linux kernel, the following vulnerability has been resolved: net: mctp: Don't access ifaindex when missing In mctpdumpaddrinfo, ifaindex can be used to filter interfaces, but only when the struct ifaddrmsg is provided. Otherwise it will be comparing to uninitialised memory - reproducible i...

CVE-2025-38082 gpio: virtuser: fix potential out-of-bound write

In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix potential out-of-bound write If the caller wrote more characters, count is truncated to the max available space in "simplewritetobuffer". Check that the input size does not exceed the buffer size. Write a zero...

CVE-2025-38082 gpio: virtuser: fix potential out-of-bound write

In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix potential out-of-bound write If the caller wrote more characters, count is truncated to the max available space in "simplewritetobuffer". Check that the input size does not exceed the buffer size. Write a zero...

CVE-2025-38081 spi-rockchip: Fix register out of bounds access

In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chip select stuff for GPIO chip selects. GPIOs can be numbered much higher than native CS. Also, it makes no sense...

CVE-2025-38081 spi-rockchip: Fix register out of bounds access

In the Linux kernel, the following vulnerability has been resolved: spi-rockchip: Fix register out of bounds access Do not write native chip select stuff for GPIO chip selects. GPIOs can be numbered much higher than native CS. Also, it makes no sense...

CVE-2025-38079 crypto: algif_hash - fix double free in hash_accept

In the Linux kernel, the following vulnerability has been resolved: crypto: algifhash - fix double free in hashaccept If accept2 is called on socket type algifhash with MSGMORE flag set and cryptoahashimport fails, sk2 is freed. However, it is also freed in afalgrelease, leading to...

CVE-2025-38073 block: fix race between set_blocksize and read paths

In the Linux kernel, the following vulnerability has been resolved: block: fix race between setblocksize and read paths With the new large sector size support, it's now the case that setblocksize can change iblksize and the folio order in a manner that conflicts with a concurrent reader and cause...

CVE-2025-38070 ASoC: sma1307: Add NULL check in sma1307_setting_loaded()

In the Linux kernel, the following vulnerability has been resolved: ASoC: sma1307: Add NULL check in sma1307settingloaded All varibale allocated by kzalloc and devmkzalloc could be NULL. Multiple pointer checks and their cleanup are added. This issue is found by our static analysis tool...

CVE-2025-38068 crypto: lzo - Fix compression buffer overrun

In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides enough buffer space, disregarding the...

CVE-2025-38067 rseq: Fix segfault on registration when rseq_cs is non-zero

In the Linux kernel, the following vulnerability has been resolved: rseq: Fix segfault on registration when rseqcs is non-zero The rseqcs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault ...

CVE-2025-38066 dm cache: prevent BUG_ON by blocking retries on failed device resumes

In the Linux kernel, the following vulnerability has been resolved: dm cache: prevent BUGON by blocking retries on failed device resumes A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initialized policy object. Repeating the resume...

CVE-2025-38066

CVE-2025-38066 affects the Linux kernel in the dm-cache subsystem (policy SMQ). The issue arises when a cache device fails to resume due to mapping errors and a resumed operation is retried, which can leave a partially initialized policy object and trigger a BUG_ON during mapping reload. The conn...

CVE-2025-38065

CVE-2025-38065: In the Linux kernel’s OrangeFS inode handling, the len variable used to store the result of i_size_read() becomes a size_t, causing truncation to 4 GiB on 32-bit systems. This can lead to incorrect file size handling and potential impact on local processes that rely on accurate si...

CVE-2025-38065 orangefs: Do not truncate file size

In the Linux kernel, the following vulnerability has been resolved: orangefs: Do not truncate file size 'len' is used to store the result of isizeread, so making 'len' a sizet results in truncation to 4GiB on 32-bit systems...

CVE-2025-38062 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie

In the Linux kernel, the following vulnerability has been resolved: genirq/msi: Store the IOMMU IOVA directly in msidesc instead of iommucookie The IOMMU translation for MSI message addresses has been a 2-step process, separated in time: 1 iommudmapreparemsi: A cookie pointer containing the IOVA...

CVE-2025-38063 dm: fix unconditional IO throttle caused by REQ_PREFLUSH

In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQPREFLUSH When a bio with REQPREFLUSH is submitted to dm, sendemptyflush generates a flushbio with REQOPWRITE | REQPREFLUSH | REQSYNC, which causes the flushbio to be throttled by...

CVE-2025-38061

CVE-2025-38061 (Linux kernel, net: pktgen) is described in connected Nessus/OS advisories as a fix for an out-of-bounds memory access in pktgen_thread_write. The root cause is failing to honor the user-supplied buffer size in strn_len() calls, which could cause memory access outside the buffer. T...

CVE-2025-38061 net: pktgen: fix access outside of user given buffer in pktgen_thread_write()

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix access outside of user given buffer in pktgenthreadwrite Honour the user given buffer size for the strnlen calls otherwise strnlen will access memory outside of the user given buffer...